anyconnect double auth

[kp-tkr2014]

Hi,

How can I enable  double authentication  for anyconnect vpn users .

For example  

1) username  and certificate

2) useranme from ldap + username from asa local database 

If I don't  need a group selection (Users should not choose a group  before they connect to vpn) , then do i need  below part ? 

tunnel-group Test webvpn-attributes
group-alias test  disable

Thanks

[Aditya Ganjoo]

Hi,

Please check the following link for the configuration:

http://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/116111-11611-config-double-authen-00.html

Regards,

Aditya

Please rate helpful posts and mark correct answers.

[kp-tkr2014]

Hi,

If I don't  need a group selection (Users should not choose a group  before they connect to vpn) , then do i need  below part ? 

tunnel-group Test webvpn-attributes
group-alias test  disable

Thanks

[Aditya Ganjoo]

Hi,

If you do not mention anything it would take care of the same.

Regards,

Aditya

Please rate helpful posts and mark correct answers.

[muhsi_2015]

Hi,

as per the document   for Single Authentication and Certificate Validation below is the sample configuration

tunnel-group RA type remote-access
tunnel-group RA general-attributes
 authentication-server-group LOCAL
 default-group-policy Group1
 authorization-required
tunnel-group RA webvpn-attributes
 authentication aaa certificate
 group-alias RA enabl

As per my setup i  have only the below part  

tunnel-group RA type remote-access
tunnel-group RA general-attributes
 authentication-server-group LOCAL
 default-group-policy Group1
 authorization-required

Since the user does not want choose the  group  I have removed  the below part 

tunnel-group RA webvpn-attributes
 authentication aaa certificate
 group-alias RA enable

Am i doing correct ? 

The question is  now  for single authentication + certificate validation how the final configuration look like ?

Thanks

[ewilliamson4922]

so under general-attributes for the tunnel there is a secondary authentication server command that will allow you to setup dual auth, the idea being  something like they login with the local username database, and then use the username and password for like RADIUS or LDAP. To see if your configuration is good you need to verify your LDAP config for aaa-server.